Skip to contentTry UnifiedONE free for 30 days. MSPs onboard up to 15 customers; businesses can ask us for an Access Code.Try UnifiedONE free for 30 daysSee how the trial works

Governance & Control Fabric

Set your security standard once. See where it slips.

Define a security baseline, see where each environment has drifted from it, and decide what to correct. Approved local exceptions stay visible instead of hiding in the noise.

Consistent security. No surprises.
Join the CommunitySee how it works

Create your account and start your guided onboarding.

  • One baseline for all
  • Drift spotted early
  • Exceptions stay approved

The problem

Settings drift quietly, one change at a time.

A quick fix here, a new environment there. Over time, environments stop matching the standard, and nobody knows exactly where.

Environment by environmentUnknown state

Nobody knows what is really configured.

Checking every environment by hand takes days and is out of date immediately.

With UnifiedONEBaseline in view

See the drift. Decide the fix.

Control Fabric compares each environment with your baseline and routes corrections for approval, with exceptions recorded.

Policy inheritance

One baseline, with local decisions still visible.

A baseline can be shared without pretending every environment is identical.

Approved baseline
IdentityApplicationsEndpointsMail
Environment branch
Regional environmentDrifted
Illustrative configuration. No customer data.

Decision ownerRegional security owner

ScopeSelected authentication controls

Expected configurationLegacy authenticationBlocked
Observed configurationLegacy authenticationAllowed

ReadingA readable value differs. Review the owner and any valid exception before correction.

Correction record
  1. Proposed
  2. Approved
  3. Applied
  4. Re-checked

These labels explain the workflow. This example does not change a connected environment.

Technology and permission limits

Reading and correction depend on connected-provider support, permissions, licensing, entitlement and the organisation's approval policy. A missing capability is never reported as aligned.

Correction record

Pass the readable record to Assurance

Keep the baseline reference, observed difference, owner decision and latest readable state together.

Built for your team

Consistent standards. For every team.

SMBs

Keep essential security settings in place as your business changes.

MSPs & MSSPs

Apply one standard across every customer and show where it holds.

Enterprises

Keep business units aligned with group policy, with visible exceptions.

SOC teams

Know whether the controls you rely on are actually configured.

Questions people ask

Configuration governance, answered.

What is a security baseline, and what does UnifiedONE enforce?

A baseline is the approved configuration you want every tenant to hold: authentication policy, administrative roles, standing access, device compliance, external sharing, application consent, data protection settings and audit logging. UnifiedONE reads the current state of each connected tenant, compares it against that baseline, and corrects the difference under the mode you chose for that control. You define the baseline. It is not handed to you as a fixed opinion.

How is this different from a posture assessment tool?

An assessment tells you where you stand on the day it runs. It hands you a ranked list and stops. Control Fabric turns the list into an enforced standard and keeps checking it, so a setting that is loosened next month is raised as a difference rather than discovered at the next assessment. Assessment is the first of five steps here, not the product.

What is configuration drift, and how quickly is it caught?

Drift is any change that moves a tenant away from its approved configuration: a policy relaxed for one project, an exception granted and forgotten, a setting flipped during troubleshooting. UnifiedONE compares live configuration against the baseline continuously, so the difference is raised when it happens and carries the old value, the new value, the time and the account that made it.

Will it change settings in my tenant without asking?

Only if you tell it to, and only per control. Observe changes nothing at all. Assist proposes the correction and waits for a named person to approve it, which is where most teams start. Act corrects on its own, and only for the control types you approved, and only when tenant authority, role, entitlement, provider capability, licensing, exception windows, approval requirements and audit requirements are all satisfied.

More questions
Does this help with NIS2, DORA and GDPR?

It produces the configuration evidence those conversations need. Your baseline controls are mapped to the framework areas they support, and an evidence pack can be produced from the real state of your tenants: posture across the estate, policy compliance control by control, and framework alignment with the underlying records attached. UnifiedONE does not certify you against a framework, and no tool can. It can reduce the manual collection that normally sits in front of the auditor's questions.

What happens when a tenant genuinely needs an exception?

You grant it, and the exception becomes part of the record rather than a hole in it. Each one carries an owner, a reason and an end date, so a tenant sitting outside the baseline shows as an approved exception instead of quiet drift, and the exception expires unless somebody renews it deliberately.

Do I need Microsoft 365 or Entra ID to use it?

Yes. Control Fabric governs connected Microsoft tenants, and connecting a tenant needs Microsoft Entra ID P1 or higher and consent from a Global Administrator. It reads configuration and policy from the tenants you connect and holds them to the configuration you approved. Your team stays the decision authority.

Can an MSP run one baseline across many customers?

That is the case it is built for. One approved configuration can be applied across every customer tenant, with customer authority preserved and per-tenant exceptions where a customer needs them. The estate view shows which tenants hold the baseline, which have drifted, which are running on an approved exception and which cannot currently be read.

Make the foundation sound. Then guard the gate.

Assess your posture, set one standard across the tenants you manage, and see where it drifts, from one platform.

Join the CommunitySee the platform

Create your account and start your guided onboarding.